A dishwasher, a US export ban and a furious letter from RSA helped set two Brisbane programmers on a path to reshaping internet security.
The first sign Tim Hudson had that his cryptographic software had arrived was when he bought a new dishwasher in 1998. The code written by his friend Eric Young and him was embedded in the whitegood.
“We wrote this stuff,” he remembers thinking. “Why is it in my dishwasher?”
It is difficult to overstate the importance of what Young and Hudson had done. In Brisbane. in their spare time. SSLeay – an all-in-one, portable, free security toolkit – became the foundation of OpenSSL, which went on to become one of the most widely deployed pieces of open-source software in the world, helping encrypt the connections between computers, phones, servers and almost everything else connected to the internet.
Much of the code written by these two Australian iconoclasts in the 1990s remains embedded in the digital infrastructure around us – and, because of the way that infrastructure is built, is likely to remain there for years to come.
Young hopes that when coders of the future dig into the certificate-testing configurations that they notice “Dodgy Brothers” in there, a reference to the shady salesmen of Australian sketch comedy show Fast Forward. Or that the “Chunky Custard” reference from Australia You’re Standing in It will bring a knowing smile.
But the strangest part of the story may be what happened next. The biggest company in the world of cryptography, RSA, started out by threatening to sue Young and Hudson back to the Stone Age, but ended up shutting its California cryptography engineering wing and moving to Brisbane to join the two troublemakers who caused an industry to be set up in Australia to avoid US laws on the export of cryptography.
And while they haven’t made a cent directly from their creation, they’ve spent the rest of their careers being well remunerated for building on top of it and continuing to keep the internet secure.
Whippersnappers
Hudson and Young met at the University of Queensland studying computer science in 1985. Young remembers Hudson as “someone who knew a lot about computers, or at least he let everyone know he did” but was nevertheless approachable and friendly.
Hudson ended up working for Mincom, a Brisbane software and services company that started out servicing mining companies but grew to handle public infrastructure, defence, oil and gas in more than 40 countries. And Young later joined him there.
They were migrating off mainframes onto smaller systems. “I got to join all the greybeards who knew the mainframe systems,” recalls Hudson. “I was the whippersnapper who knew all the modern new stuff.”
During the 90s, Mincom saw an opportunity to cut costs if they could stop using dedicated lines for data communications and instead use this thing they were hearing about called the internet.
“There were a couple of the board members at Mincom who said ‘Hey Tim, you’re into breaking things, you’re into how things work, can you give us security on top of this internet thing?’”
Hudson told them no, he couldn’t. “But about four months later, Netscape Navigator launches with SSL in it.” SSL [Secure Sockets Layer] encrypts data travelling between a computer and a website.
Hudson could see it would save everybody a lot of money. Banks were getting on board, so it must be good enough. He reached out to license the tech from Netscape but they told him they couldn’t because of export controls designed to stop foreign bad actors getting hold of strong encryption. “Sorry Tim, you can’t license it with proper security. You can only license it with weakened security.”
“This intrigued me. How does one divide one massive number by another?”
Eric A. Young
Only American bad actors could get it.
“I can’t, as a technologist at Mincom go to our customers and say, ‘buy this thing, it’s not really secure’.”
Young remembers that Hudson came to see him and asked if he might be able to do something like Netscape’s SSL. “I had a look at the specification, and I saw it would need the RSA [the then world leading encryption company] algorithm, and this would, amongst other things, involve dividing very large numbers. This intrigued me. How does one divide one massive number by another?” Young told Forbes Australia via email.
That’s how Eric A. Young came to write SSLeay, a software implementation of SSL, with the last three letters of the name he gave it being his initials.
Too good to refuse
Some of the code that would become OpenSSL is older still. Young had previously written a “network-sniffing” program to monitor traffic, and a library from that program called lhash remains in OpenSSL today.
The first time he ever used a web browser was when testing his algorithm. “Australia did not have the internet yet,” says Young.
That was 1995. By 1997–98, Young and Hudson were working for C2Net, a US company whose flagship product was Stronghold, an Apache-based web server designed to provide strong encryption internationally. C2Net needed SSLeay because US export restrictions meant they couldn’t sell American cryptography to the rest of the world. But they could export code built on this free Aussie open-source product.
“Heartbleed was the worst thing that ever happened to OpenSSL. It was also the best thing that ever happened to OpenSSL.”
Tim Hudson
It took three years before RSA sent the angry legal letter threatening to take Young and Hudson for everything they owned. But six months after that, the company made Young and Hudson an offer they couldn’t – and didn’t – refuse.
“I ended up working for RSA for nine years and Eric’s still there,” says Hudson.
Hudson said it was pure economics that drove RSA to make the offer. “We had everything they needed and we weren’t inside America. They couldn’t export the crypto [cryptography] so they wanted to build all the cryptography in Australia. The whole thing was to shut down the American operation for building security toolkits and set it up in Brisbane.”
“At one stage we were close to 100 people in Brisbane working on this … So here’s this ‘evil company’ … but working for them was a really good experience. They were incredible people to work with.”
Forking hell
With Young and Hudson now at RSA, a new group of developers took the SSLeay code, “forked it” and began building what became OpenSSL.
OpenSSL stayed out there keeping the internet safe, but the team of people maintaining it for free in their basements was dwindling. People would add patches to fix various problems and they’d be checked by volunteers, but …
A 2012 patch had a bug that the two volunteers running it missed. It was picked up on by attackers in 2014. They could send a specially crafted heartbeat request to vulnerable servers, tricking OpenSSL into returning chunks of memory that could contain passwords, private keys and other sensitive data.
The crisis was global. The “Heartbleed” bug exposed millions of websites and devices, forcing emergency patches and password resets. It was estimated to affect 17% of the internet’s secure web servers.
“I had my mother calling me and saying, ‘Tim do I need to stop using my banking system?’” recalls Hudson. “Heartbleed was the worst thing that ever happened to OpenSSL,” says Hudson. “It was also the best thing that ever happened to OpenSSL.”
It led to a revamp of how everything worked and a new enthusiasm. “It woke up the industry, and it woke up the team working on it that we’ve got to try something better.
“We got more people involved. I got more heavily involved … It rebooted its governance, and I instituted that no code can go in the code base without two people reviewing it and signing off.”
In 2024, Hudson took the whole OpenSSL team out to his farm three and a half hours west of Brisbane to play with earth moving equipment and then decide the future of internet security.
“After isolating them and basically saying, ‘Why are you doing what you’re doing? What’s your motivator?’ It turned out that we all had slightly different motivations, but the underlying thing behind everything is that we all wanted people to have protection that didn’t depend on how much money they had.”
They decided OpenSSL needed to split into two co-equal organisations: a foundation responsible for the interests of individuals, academics and researchers, and a corporation focused on commercial customers. Hudson was elected president of the corporation; neither side can force the other to do anything. “We cooperate by choice, not by force,” he says.
The commercial operation now takes in about $6 million a year from support contracts “with billion-or-trillion-dollar companies”. It employs about 16 people and funds the foundation, conferences and development, and aims to break even rather than distribute profits.
Grumpy young men
Young still works at RSA as a “distinguished engineer”.
Hudson revamped a company the duo started in the 90s, Cryptsoft, in 2007. He didn’t have to spruik for business. “Pretty much any security architect in any major company has been dealing with me for an extended time. All of a sudden I’m in Cryptsoft and they come knocking on the door … It’s like, ‘We’ve been trusting this guy for 15 years. He’s got his own company now. Let’s go and buy his product.’”
It has between 10 and 12 employees. “I learned harsh lesson that when I get to 14 people, I can’t do anything else. So that’s the size I like organizations to be.”
Does he ever wonder what might have happened had he and Young tried to commercialise SSLeay in 1995 and jumped on the dotcom boom?
“We would have both been grumpy and left. Me, when we got to employee number 15. And Eric, when he had to go to yet another meeting and tell stupid people that they’re stupid.”
Tim Hudson, Eric Young and OpenSSL Foundation president Matt Caswell will present a keynote, “Illuminating the History of SSLeay: Thirty-One Years Apart” at the OpenSSL conference in Prague in October.
Want to see more Forbes articles on your feed? Tap here to make Forbes Australia a preferred source on Google.
Look back on the week that was with hand-picked articles from Australia and around the world. Sign up to the Forbes Australia newsletter here or become a member here.
